Low Severity
CVE-2026-109618
Published: Oct 29, 2026
PHP2Shell — CVE-2026-109618/109619 exploit toolkit: 5 chains + JA3 stealth + mass scan + safe webshell. Authorized testing only.
# PHP2Shell
**CVE-2026-109618 / CVE-2026-109619 exploit toolkit — 5 chains + JA3/TLS stealth + mass scan + safe webshell. Authorized testing only.**
PHP2Shell is a PHP `session.upload_progress` stale-state use-after-free that yields unauthenticated remote code execution. This toolkit ports the public research into a single, guarded, scan-ready CLI: detect, score, exploit, and (optionally) drop a password-protected webshell — all behind one consistent browser fingerprint so a target only ever sees one identity.
> **Authorized testing only.** Every target must be yours or covered by written authorization (engagement, lab, bug-bounty scope). Running this against systems you do not own is a crime in most jurisdictions.
---
## What this is
| | |
|---|---|
| **CVE tested (full chain)** | CVE-2026-109619 — 2-request `session.upload_progress` UAF + ASLR bypass via heap/libphp leak + `pDestructor = zif_system` |
| **CVE detected (version only)** | CVE-2026-109618 — OOM corruption, single request. Different chain, **not** run by this toolkit. |
| **CVSS** | 9.2 (Critical) |
| **Affected** | PHP 5.4 – 8.x, fixed in 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 (2026-10-21) |
| **Stealth** | `curl_cffi` JA3/TLS impersonation (Chrome / Safari / Firefox / Edge / Android) on every request |
| **Transport** | HTTP and **HTTPS** targets (`--url https://…`), TLS verification off by default (self-signed/internal CAs are the norm) |
| **Chains** | 5 — production (128M, `display_errors=Off`), 8M remote, local UAF, handler mismatch, session injection |
| **Tests** | 74 unit tests (syntax, guards, classification, OOM signals, CLI smoke) |
### Credit
CVE-2026-109618/109619 was first found by **Calif (Ryan A.)** on 1 Aug 2026 and reported to PHP on 11 Aug 2026. **Wiz Research** found it independently (19 Aug, reported 24 Aug) — [wiz.io/blog/php2shell-php-rce](https://wiz.io/blog/php2shell-php-rce). **OpenAI Codex Security** reported an additional vector on 18 Sep. All three are credited in the